fix bug creating layer records on non-tagged pushes

pkg/appview/storage/manifest_store.go

@@ -224,7 +224,9 @@ func (s *ManifestStore) Put(ctx context.Context, manifest distribution.Manifest,
 
 	// Notify hold about manifest push (for layer tracking, Bluesky posts, and stats)
 	// Do this asynchronously to avoid blocking the push
-	if tag != "" && s.ctx.ServiceToken != "" && s.ctx.Handle != "" {
+	// Note: We notify even for tagless pushes (e.g., buildx platform manifests) to create layer records
+	// Bluesky posts are only created for tagged pushes (handled by hold service)
+	if s.ctx.ServiceToken != "" && s.ctx.Handle != "" {
 		go func() {
 			defer func() {
 				if r := recover(); r != nil {

pkg/hold/oci/xrpc.go

@@ -350,8 +350,9 @@ func (h *XRPCHandler) HandleNotifyManifest(w http.ResponseWriter, r *http.Reques
 			}
 		}
 
-		// Create Bluesky post if enabled
-		if postsEnabled {
+		// Create Bluesky post if enabled and tag is present
+		// Skip posts for tagless pushes (e.g., buildx platform manifests pushed by digest)
+		if postsEnabled && req.Tag != "" {
 			// Resolve handle from DID (cached, 24-hour TTL)
 			_, userHandle, _, resolveErr := atproto.ResolveIdentity(ctx, req.UserDID)
 			if resolveErr != nil {